[SOLVED] Preparing text for database insert

[galvin]

Just curious if you exprets feel this is a safe enough function to properly prepare text that is getting submitted into a database.  If you feel there are better options, please let me know the function names so I can read up on them...

<?php


function mysql_prep($value) {
	$magic_quotes_active = get_magic_quotes_gpc();
	$new_enough_php = function_exists("mysql_real_escape_string") ; //i.e. PHP >= v4.3.0
	if($new_enough_php) { //PHP v4.3.0 or higher
		//undo any magic quote effects so mysql_real_escape_string can do the work
		if($magic_quotes_active) { $value = stripslashes($value) ;}
		$value = mysql_real_escape_string($value);
	} else { //before php v4.3.0
		// if magic quotes aren;t already on then add slashes manually
		if(!magic_quotes_active) { $value = addslashes($value); }
		// if magic quotes are active, then the slashes already exist
	}
	return $value;
}

?>

[DeanWhitehouse]

you could just do mysql_real_escape_string();

[Mad Mick]

Unless you are designing scripts for sale, I see no need to provide support for older PHP versions (or at least not as old as v4).  If your webhosting service does not provide PHP5 then its time to change.

 

I would disable magic quotes as standard then just use mysql_real_escape_string().

[galvin]

Thanks guys!